Information-stealing malware is expanding its collection logic to target locally stored data from AI coding agents, including Claude, Cursor, Codex, Cline, Continue, and OpenCode.
The shift puts developer credentials, Model Context Protocol configurations, prompt histories, project metadata, and potentially proprietary source code into the same theft pipeline long used for browser cookies, cryptocurrency wallets, and password stores.
On Windows, Amatera has been observed targeting data related to Cline and Continue. In contrast, Remus targets artifacts associated with Claude, Cursor, and OpenCode.
The company recorded detections involving Amatera and Remus among tens of thousands of protected users over a three-month period, although the figures represent detections rather than confirmed successful infections.
The issue is not a newly disclosed flaw in an AI model, coding assistant, or agent framework.
Instead, attackers are exploiting the growing concentration of high-value data in predictable local locations on endpoints that have already been compromised by commodity infostealers.
Where agent files contain plaintext data or reusable authentication material, criminals can collect them by adding a path, filename, database, or extension to an existing remotely managed collection configuration.
CallbackBeaver has reportedly added Claude and Cursor to its targeting scope, with researchers observing more than 5,000 samples in a recent 30-day period.
Other lower-prevalence families, including BeeStealer, STG Stealer, HydraStealer, APEX Stealer, and Otter Stealer, also demonstrate that AI-agent harvesting is spreading across the infostealer ecosystem.
On macOS, Djinn Stealer has been linked to collection of local data from Claude, Codex, Gemini, Cline, OpenCode, and Kilo.
The value of AI-agent data lies in the combination of access and operational context. Local agent data can include access tokens, refresh tokens, account identifiers, subscription information, conversation databases, prompt histories, recently accessed files, project names, and configuration artifacts.
A stolen access token may enable an attacker to consume paid AI-service capacity or gain temporary access to an account; a refresh token could prolong that access, depending on the service’s controls and token lifetime.
The exposure can become more severe where an agent uses the Model Context Protocol. MCP enables AI agents to connect with external tools and enterprise data sources.
Local configurations may hold endpoints, authorization headers, environment variables, API keys, or other credentials.
If reusable secrets are present, an infostealer compromise could extend beyond the AI account to connected source-control platforms, ticketing systems, cloud services, databases, and collaboration environments.
Prompt histories introduce a separate but equally serious risk. Developers routinely use coding agents to interpret logs, review source code, troubleshoot incidents, summarize internal documentation, and plan unfinished features.
Those records may expose internal hostnames, repository structures, security controls, customer data, API keys, or trade secrets.
Gen Digital’s threat researchers found that, multiple stealer families have already added AI-agent directories and associated files to their collection rules.
For attackers, the archive can function as pre-collected reconnaissance, allowing more convincing spear-phishing, extortion, account takeover, or follow-on intrusion activity.
The addition of a new AI assistant may not require malware operators to rebuild or redistribute a payload.
Many stealers retrieve dynamic rules that define target directories, filenames, search depth, file-size limits, browser databases, and extensions.
Once an operator identifies a useful local storage path, existing infections may begin harvesting a newly popular tool after a simple configuration update.
That operational flexibility matters at scale. Gen Digital recorded infostealer detections affecting more than 3.3 million unique protected users during the first half of 2026, with monthly totals consistently above 500,000.
Those figures cover the broader infostealer landscape, not exclusively AI-agent targeting, but they illustrate the distribution ecosystem now absorbing agent data as a monetizable asset.
Remus itself illustrates the technical maturity behind this trend. Researchers assess the x64 malware as a Lumma Stealer variant, citing shared string obfuscation, anti-VM checks, syscall handling, indirect control-flow obfuscation, and an Application-Bound Encryption bypass.
Remus also uses Ethereum smart contracts for EtherHiding-based command-and-control resolution, making its infrastructure more resilient than traditional dead-drop mechanisms hosted on services such as Telegram or Steam.
Organizations should treat AI-agent files as part of the identity and access attack surface.
Agent deployments need inventorying, while administrators should identify where each tool stores credentials, prompt histories, project records, and MCP configuration.
Wherever supported, teams should prefer OS-backed credential stores, keychains, or keyrings over file-based token storage.
Developers should avoid placing passwords, private keys, long-lived API secrets, and regulated data in prompts or persistent histories.
MCP integrations should be assigned narrowly scoped, short-lived credentials and separated across personal, development, and production environments.
Old agent connections and unused MCP servers should be regularly reviewed and revoked.
Following a suspected infostealer incident, resetting browser passwords is no longer sufficient.
Incident responders should work from a clean system to revoke AI-service sessions, rotate API keys and MCP-connected credentials, review agent-linked account activity, and assess whether local conversations or project artifacts exposed confidential information.
Multi-factor authentication remains essential, but it may not prevent abuse when an attacker has already stolen an active session token.
★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
